MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92459aab5fc4c348f5a6a10fa7ce8bc734121a8e2d8d3c30e4337f74ae87017a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	92459aab5fc4c348f5a6a10fa7ce8bc734121a8e2d8d3c30e4337f74ae87017a
SHA3-384 hash:	737ac89ed2627ec229e633847d7e4f54c4fcd87b456ecb607a5ca481aa07b47f8ebdce149838d4552e60cdb338eedb55
SHA1 hash:	9e483f008a259c91f0be260a8a56e833a623dd89
MD5 hash:	b1f18c7fad0da8842863681a074c8a35
humanhash:	winner-table-california-missouri
File name:	555555555.png
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	1'205'264 bytes
First seen:	2020-09-18 17:06:52 UTC
Last seen:	2020-09-18 17:50:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3bd7c16a16ad7d5b3966a30a82496732 (7 x Quakbot)
ssdeep	6144:9Ug69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6kr:q99trKTX84bkQfUO/aQdeMo3e+k4jACU
Threatray	428 similar samples on MalwareBazaar
TLSH	D145D06AB777C491F3E91FF605E207AC5A7BA895BB214007259A3F1D7CF23903C2644A
Reporter	dripbrrr
Tags:	abc005 Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

192

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Variant.Razy.751573.1699.19323.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a process with a hidden window

Creating a file in the Windows subdirectories

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Launching a process

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Threat name:

Qbot

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/470328

Signature

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect virtual machines (IN, VMware)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Qbot

Behaviour

Behavior Graph:

Download SVG

Detection:

qakbot

Link:

https://mwdb.cert.pl/sample/92459aab5fc4c348f5a6a10fa7ce8bc734121a8e2d8d3c30e4337f74ae87017a/

Threat name:

Win32.Trojan.PinkSbot

Status:

Malicious

First seen:

2020-09-18 17:08:08 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=sjczvk27ytbur5ngueh2ptuly42beguofwgtymhegn7xjluhaf5a._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

trojan banker stealer family:qakbot

Link:

https://tria.ge/reports/200918-lwsyg9b4k2/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Executes dropped EXE

Qakbot/Qbot

Malware Config

C2 Extraction:

50.244.112.10:995
207.237.1.152:443
184.97.148.2:443
207.255.161.8:993
69.167.206.238:50001
72.36.59.46:2222
173.26.189.151:443
2.50.59.177:443
217.162.149.212:443
199.247.22.145:443
203.106.195.67:443
109.154.214.224:2222
117.199.14.31:443
175.211.225.118:443
188.51.33.232:995
50.244.112.106:443
65.30.213.13:6882
24.37.178.158:443
47.28.131.209:443
207.255.161.8:995
141.158.47.123:443
72.204.242.138:990
188.25.244.220:443
46.248.56.248:995
2.7.65.32:2222
202.141.244.118:995
98.16.204.189:995
189.231.196.236:443
2.91.73.105:995
81.133.234.36:2222
98.121.187.78:443
84.117.176.32:443
24.205.42.241:443
50.104.68.223:443
213.31.203.48:2222
188.210.225.179:443
209.137.209.163:995
36.77.151.211:443
95.77.223.148:443
207.246.75.201:443
45.77.193.83:443
45.32.154.10:443
59.26.204.144:443
67.170.137.8:443
80.195.103.146:2222
65.131.41.15:995
72.190.101.70:443
24.53.49.240:2222
5.12.0.239:443
96.237.141.134:995
37.210.186.213:61201
98.26.50.62:995
173.245.152.231:443
78.96.199.79:443
74.56.167.31:443
199.116.241.147:443
94.52.68.72:443
96.30.198.161:443
95.179.247.224:443
108.5.34.248:443
199.247.16.80:443
24.231.54.185:2222
92.59.35.196:2222
110.159.189.54:443
72.204.242.138:20
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
72.204.242.138:53
69.123.116.167:2222
93.113.177.152:443
68.46.142.48:995
47.146.169.85:443
79.118.120.51:2222
74.75.216.202:443
173.22.125.129:2222
200.75.136.78:443
80.14.209.42:2222
84.78.128.76:2222
86.122.241.39:2222
72.209.191.27:443
185.246.9.69:995
71.221.92.98:443
71.12.214.209:2222
80.240.26.178:443
108.30.125.94:443
190.85.91.154:443
67.60.113.253:2222
75.87.161.32:995
203.198.96.200:443
71.197.126.250:443
66.222.88.126:995
47.146.32.175:443
200.124.231.21:443
24.201.79.208:2078
24.234.86.201:995
73.228.1.246:443
172.78.30.215:443
2.90.109.29:995
134.0.196.46:995
178.222.113.168:995
77.159.149.74:443
41.44.218.243:995
95.76.109.181:443
39.36.105.140:995
188.247.252.243:443
72.82.15.220:443
166.62.180.194:2078
103.76.160.110:443
103.110.49.88:443
70.124.29.226:443
2.50.112.11:20
47.44.217.98:443
216.201.162.158:443
89.42.142.35:443
71.126.139.251:443
71.84.5.114:995
108.178.66.82:995
134.228.24.29:443
76.170.77.99:995
184.98.103.204:995
108.185.113.12:443
96.41.93.96:443
216.163.4.136:443
96.18.240.158:443
66.215.32.224:443
35.134.202.234:443
181.91.255.26:443
117.218.208.239:443
72.204.242.138:32102
144.139.47.206:443
207.255.161.8:465
45.32.155.12:443
59.99.37.23:443
66.208.105.6:443
71.187.170.235:443
68.174.15.223:443
207.255.161.8:32100
207.255.161.8:2078
98.22.65.76:443
68.174.9.179:443
67.165.206.193:993
72.204.242.138:465
107.77.236.109:0
69.11.247.242:443
75.81.25.223:443
207.255.18.67:443
103.206.112.234:443
50.232.172.114:443
75.136.40.155:443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

qbot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/92459aab5fc4c348f5a6a10fa7ce8bc734121a8e2d8d3c30e4337f74ae87017a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/63493/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample